Systems and methods for recognizing behavorial attributes of software in real-time

Abstract

A computer-implemented method for recognizing behavioral attributes of software in real-time is described. An executable file is executed. One or more runtime events associated with a behavior of the executable file are traced. The one or more traced runtime events are translated to a high level language. A recognizable pattern of the translated traced runtime events is produced. The pattern is a unique behavioral set of the translated traced runtime events.

What is claimed is: 
     
       1. A computer-implemented method for recognizing behavioral attributes of software in real-time, comprising:
 executing an executable file; 
 tracing one or more non-sequential runtime events and a set of inter-related dynamic characteristics associated with the one or more non-sequential runtime events, the set of inter-related dynamic characteristics being associated with a behavior of the executable file, the one or more runtime events comprising a function call and abstract data types; 
 translating the one or more non-sequential traced runtime events and the set of inter-related dynamic characteristics from machine code to a high level language, the high level language comprising one or more labels written in human-readable text to describe the one or more traced non-sequential runtime events and the set of inter-related dynamic characteristics; and 
 producing a recognizable pattern of the translated traced non-sequential runtime events based at least in part on the set of inter-related dynamic characteristics, wherein the pattern comprises a unique behavioral set of the translated traced runtime events. 
 
     
     
       2. The method of  claim 1 , further comprising distributing the recognizable pattern to one or more client terminals. 
     
     
       3. The method of  claim 2 , wherein the recognizable pattern is distributed to the one or more client terminals via a web server. 
     
     
       4. The method of  claim 1 , wherein the one or more non-sequential runtime events are traced using Application Programming Interface (API) calls. 
     
     
       5. The method of  claim 1 , wherein the one or more non-sequential runtime events are traced using subroutine calls. 
     
     
       6. The method of  claim 1 , wherein the high level language describes absolute memory locations of the one or more traced non-sequential runtime events. 
     
     
       7. The method of  claim 1 , further comprising manually identifying non-sequential runtime events to translate to the high level language. 
     
     
       8. The method of  claim 1 , further comprising automatically identifying non-sequential runtime events to translate to the high level language. 
     
     
       9. The method of  claim 1 , wherein the method is implemented by a server. 
     
     
       10. A computer-implemented method for recognizing behavioral attributes of software in real-time, comprising:
 receiving one or more recognizable patterns from a server, wherein the one or more patterns are associated with non-sequential runtime events and a set of inter-related dynamic characteristics of an executable file, the non-sequential runtime events and the set of inter-related dynamic characteristics being associated with a behavior of the executable file, and comprising a function call and abstract data types, the non-sequential runtime events of the executable file being translated from machine code to a high level language, the high level language comprising one or more labels written in human-readable text to describe the one or more traced non-sequential runtime events and the set of inter-related dynamic characteristics; 
 executing an unidentified executable file; 
 monitoring runtime events associated with the unidentified executable file; 
 associating the monitored runtime events with a recognizable pattern received from the server; and 
 identifying the unidentified executable file based on the recognizable pattern associated with the monitored runtime events, the recognizable pattern being based on the one or more labels. 
 
     
     
       11. The method of  claim 10 , further comprising implementing kernel based components to monitor the runtime events of the unidentified executable file. 
     
     
       12. The method of  claim 10 , further comprising identifying the unidentified executable file as a malicious executable file. 
     
     
       13. The method of  claim 10 , further comprising identifying the unidentified executable file as a non-malicious executable file. 
     
     
       14. A server system configured to recognize behavioral attributes of software in real-time, comprising:
 a processor; 
 memory in electronic communication with the processor; 
 the server configured to:
 execute an executable file; 
 trace one or more non-sequential runtime events and a set of inter-related dynamic characteristics associated with the one or more non-sequential runtime events, the set of inter-related dynamic characteristics being associated with a behavior of the executable file, the one or more runtime events comprising a function call and abstract data types; 
 translate the one or more non-sequential traced runtime events and the set of inter-related dynamic characteristics from machine code to a high level language, the high level language comprising one or more labels written in human-readable text to describe the one or more traced non-sequential runtime events and the set of inter-related dynamic characteristics; and 
 produce a recognizable pattern of the translated traced non-sequential runtime events based at least in part on the set of inter-related dynamic characteristics, wherein the pattern comprises a unique behavioral set of the translated traced runtime events. 
 
 
     
     
       15. The system of  claim 14 , wherein the server is further configured to distribute the recognizable pattern to one or more client terminals. 
     
     
       16. The system of  claim 15 , wherein the recognizable pattern is distributed to the one or more client terminals via a web server. 
     
     
       17. The system of  claim 14 , wherein the one or more non-sequential runtime events are traced using Application Programming Interface (API) calls. 
     
     
       18. The system of  claim 14 , wherein the one or more non-sequential runtime events are traced using subroutine calls. 
     
     
       19. The system of  claim 14 , wherein the high level language describes absolute memory locations of the one or more non-sequential traced runtime events. 
     
     
       20. The system of  claim 14 , wherein the server is further configured to manually identify non-sequential runtime events to translate to the high level language.